Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
28/01/2024, 12:52
Static task
static1
Behavioral task
behavioral1
Sample
babbb.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
babbb.exe
Resource
win10v2004-20231222-en
General
-
Target
babbb.exe
-
Size
764KB
-
MD5
5040eb019a579d7d5b583ccc285c2732
-
SHA1
9a689878c6aee62a6f5f6634d05d999f543365bb
-
SHA256
0bf6ae6361d96420e17922aca4af1f02ab2f3f01d67cd14148f187fd2de4f51b
-
SHA512
c4efdb54a752e309a574b9a769f5b2365f65ee1690e322bb6364e288c5f8f3196eb4b5122979af517706d463c6f2291d05ca664b8a1d22c2abc6feed5b6c223f
-
SSDEEP
6144:F1NBdGYC2Ri6+GpplN8HTy4KV/ftexpq01Tek9TaASdJW6Di:F1N7GYtRi6Hczy4KJl+ekdaBJWF
Malware Config
Extracted
warzonerat
bossnew.ddns.net:1001
Signatures
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT payload 7 IoCs
resource yara_rule behavioral2/memory/4028-9-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat behavioral2/memory/4028-12-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat behavioral2/memory/4028-13-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat behavioral2/memory/4028-17-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat behavioral2/memory/4948-32-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat behavioral2/memory/4948-33-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat behavioral2/memory/4948-35-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat -
Drops startup file 3 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cvcvsdf.exe babbb.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cvcvsdf.exe babbb.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cvcvsdf.exe bab.exe -
Executes dropped EXE 5 IoCs
pid Process 3140 cvcvsdf.exe 4028 cvcvsdf.exe 1924 bab.exe 2240 cvcvsdf.exe 4948 cvcvsdf.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\bab = "C:\\ProgramData\\bab.exe" cvcvsdf.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 3140 set thread context of 4028 3140 cvcvsdf.exe 86 PID 2240 set thread context of 4948 2240 cvcvsdf.exe 92 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2336 babbb.exe 3140 cvcvsdf.exe 1924 bab.exe 2240 cvcvsdf.exe -
Suspicious use of WriteProcessMemory 31 IoCs
description pid Process procid_target PID 2336 wrote to memory of 3140 2336 babbb.exe 84 PID 2336 wrote to memory of 3140 2336 babbb.exe 84 PID 2336 wrote to memory of 3140 2336 babbb.exe 84 PID 3140 wrote to memory of 4028 3140 cvcvsdf.exe 86 PID 3140 wrote to memory of 4028 3140 cvcvsdf.exe 86 PID 3140 wrote to memory of 4028 3140 cvcvsdf.exe 86 PID 3140 wrote to memory of 4028 3140 cvcvsdf.exe 86 PID 3140 wrote to memory of 4028 3140 cvcvsdf.exe 86 PID 3140 wrote to memory of 4028 3140 cvcvsdf.exe 86 PID 3140 wrote to memory of 4028 3140 cvcvsdf.exe 86 PID 3140 wrote to memory of 4028 3140 cvcvsdf.exe 86 PID 3140 wrote to memory of 4028 3140 cvcvsdf.exe 86 PID 3140 wrote to memory of 4028 3140 cvcvsdf.exe 86 PID 3140 wrote to memory of 4028 3140 cvcvsdf.exe 86 PID 4028 wrote to memory of 1924 4028 cvcvsdf.exe 90 PID 4028 wrote to memory of 1924 4028 cvcvsdf.exe 90 PID 4028 wrote to memory of 1924 4028 cvcvsdf.exe 90 PID 1924 wrote to memory of 2240 1924 bab.exe 91 PID 1924 wrote to memory of 2240 1924 bab.exe 91 PID 1924 wrote to memory of 2240 1924 bab.exe 91 PID 2240 wrote to memory of 4948 2240 cvcvsdf.exe 92 PID 2240 wrote to memory of 4948 2240 cvcvsdf.exe 92 PID 2240 wrote to memory of 4948 2240 cvcvsdf.exe 92 PID 2240 wrote to memory of 4948 2240 cvcvsdf.exe 92 PID 2240 wrote to memory of 4948 2240 cvcvsdf.exe 92 PID 2240 wrote to memory of 4948 2240 cvcvsdf.exe 92 PID 2240 wrote to memory of 4948 2240 cvcvsdf.exe 92 PID 2240 wrote to memory of 4948 2240 cvcvsdf.exe 92 PID 2240 wrote to memory of 4948 2240 cvcvsdf.exe 92 PID 2240 wrote to memory of 4948 2240 cvcvsdf.exe 92 PID 2240 wrote to memory of 4948 2240 cvcvsdf.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\babbb.exe"C:\Users\Admin\AppData\Local\Temp\babbb.exe"1⤵
- Drops startup file
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cvcvsdf.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cvcvsdf.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3140 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cvcvsdf.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cvcvsdf.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4028 -
C:\ProgramData\bab.exe"C:\ProgramData\bab.exe"4⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cvcvsdf.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cvcvsdf.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cvcvsdf.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cvcvsdf.exe"6⤵
- Executes dropped EXE
PID:4948
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
764KB
MD55040eb019a579d7d5b583ccc285c2732
SHA19a689878c6aee62a6f5f6634d05d999f543365bb
SHA2560bf6ae6361d96420e17922aca4af1f02ab2f3f01d67cd14148f187fd2de4f51b
SHA512c4efdb54a752e309a574b9a769f5b2365f65ee1690e322bb6364e288c5f8f3196eb4b5122979af517706d463c6f2291d05ca664b8a1d22c2abc6feed5b6c223f